CVE-2025-59468 is a command injection flaw in Veeam Backup & Replication 13 that lets a Backup Administrator run code as the postgres user through a malicious password parameter. The NVD record scores it CVSS 9.0. Veeam fixed it in 13.0.1.1071, so update.
What's affected
Veeam's KB4792 says all vulnerabilities in the article affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds. Version 12.x and older are not impacted. The fix is in 13.0.1.1071, and the KB was published on 6 January 2026.
A note on severity: the NVD record lists CVSS 9.0, while the Veeam article rates this CVE Medium with a score of 6.7. Scoring sources differ, so decide your urgency by looking at who holds the Backup Administrator role in your environment. The Veeam article says the issue was found during internal testing.
The same KB covers other CVEs, including CVE-2025-55125, which allows a Backup or Tape Operator to run code as root through a malicious backup configuration file. Updating once covers the whole list.
How to check if you're exposed
In the Veeam console, open the About dialog and read the build number. If you run version 13 and the build is below 13.0.1.1071, you are in scope. If you run 12.x, the Veeam article says these issues do not apply.
Then review roles. The issue needs the Backup Administrator role, so list who holds it and which accounts are service accounts. Check that the console and backup server are reachable only from a management network.
What to do now
- Download and install Veeam Backup & Replication 13.0.1.1071 or later, following Veeam's upgrade notes.
- Take a configuration backup first, and record your current build number.
- Cut the list of Backup Administrators and Operators to the people who need those roles.
- Require multi factor sign in for the console where your setup supports it.
- Keep the backup server off the general network and out of the domain forest your users share, where practical.
- Review audit events for role changes and unusual password parameters in the period before the update.
Why it matters
The class is CWE-77, improper neutralization of special elements used in a command. The password value was passed into a command without being fully checked, so a crafted value could change the command that ran. The record says the effect is code execution as the postgres user, the account behind the product's database.
A privileged role is required, so this is a privilege boundary issue more than an open door. Even so, backup servers are favoured targets: they hold copies of everything, and attackers who gain admin rights often try to destroy or read them. Limiting roles and patching quickly keeps a role compromise from becoming a database compromise. The KEV flag for this CVE is false.
Quick check
Are Veeam Backup & Replication 12 installs affected?
No. The Veeam article says 12.x and older are not impacted by the vulnerabilities in KB4792.
Sources
Last reviewed: 19 October 2026.
